FROM python:3.11-slim

ENV PYTHONDONTWRITEBYTECODE=1 \
    PYTHONUNBUFFERED=1

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY . .

# Secrets (flask_secret.key, encryption.key) and the SQLite DB live here.
# Mount a volume so they survive container restarts.
VOLUME ["/app/instance"]

EXPOSE 5000

# --preload generates/loads the secrets once in the master before forking,
# so all workers share the same keys. Provide RDP_MANAGER_PASSWORD (and ideally
# SECRET_KEY and RDP_ENCRYPTION_KEY) via the runtime environment — see .env.example.
CMD ["gunicorn", "--preload", "--workers", "2", "--bind", "0.0.0.0:5000", "wsgi:application"]
